Alpine: webkit2gtk: security update to 2.34.6-r0

high Tenable Cloud Security Plugin ID 427704

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 15.3 and
iPadOS 15.3, watchOS 8.4, tvOS 15.3, Safari 15.3, macOS Monterey 12.2. Processing a maliciously crafted
mail message may lead to running arbitrary javascript. (CVE-2022-22589)

- A use after free issue was addressed with improved memory management. This issue is fixed in iOS 15.3 and
iPadOS 15.3, watchOS 8.4, tvOS 15.3, Safari 15.3, macOS Monterey 12.2. Processing maliciously crafted web
content may lead to arbitrary code execution. (CVE-2022-22590)

- A logic issue was addressed with improved state management. This issue is fixed in iOS 15.3 and iPadOS
15.3, watchOS 8.4, tvOS 15.3, Safari 15.3, macOS Monterey 12.2. Processing maliciously crafted web content
may prevent Content Security Policy from being enforced. (CVE-2022-22592)

- A use after free issue was addressed with improved memory management. This issue is fixed in macOS
Monterey 12.2.1, iOS 15.3.1 and iPadOS 15.3.1, Safari 15.3 (v. 16612.4.9.1.8 and 15612.4.9.1.8).
Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a
report that this issue may have been actively exploited.. (CVE-2022-22620)

Plugin Details

Severity: High

ID: 427704

Version: Revision 1.4

Type: Local

Family: Alpine Linux Local Security Checks

Published: 5/16/2025

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: High

Score: 7.7

Percentile: 99.08

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.6

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2022-22620

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 8.2

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 1/27/2022

CISA Known Exploited Vulnerability Due Dates: 2/25/2022

Reference Information

CVE: CVE-2022-22589, CVE-2022-22590, CVE-2022-22592, CVE-2022-22620

Detections

Analytics